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The Santa Clara Valley Water District (District) is the largest multi-purpose water supply, 
watershed stewardship and flood management special district in California, covering 1,300 square 
miles of the Silicon Valley. The District, governed by seven elected Board of Directors to oversee 
the management of the District, is responsible for ensuring a safe, reliable water supply, reducing 
toxins, hazards, and contaminants in waterways, protecting water supplies from natural disasters, 
restoring wildlife habitat, and providing flood protection. 


The District engaged TAP International to conduct a District-wide risk assessment of operations 
for FY 2017-18. Generally Accepted Government Auditing Standards suggest use of a risk 
assessment to prioritize limited financial resources on areas that need immediate attention. 


The results of the risk assessment are used to assist in the development of an Annual Audit Work 
Plan. The Annual Audit Work Plan also includes the audit suggestions of individual Board 
members and District staff. The Annual Audit Work Plan will be prepared under separate cover. 


Risks, from an audit perspective, represent improvement opportunities that could result from active 
monitoring or from audits. The identification of risk areas does not necessarily indicate that a 
problem is currently present. All public agencies have risk that could be inherent or be specific 
risks. An example of inherent risk is managing a multi-million capital construction program. The 
magnitude of the District’s financial investment into capital projects is the leading cause of the 
inherent risk. One example of a specific risk is repeated cost overruns on capital construction 
projects. 


The risk assessment was based on interviews and reviews of reports, plans, budgets, and other 
District-generated information. Staff interviews were conducted at the executive and mid- 
management levels across 13 offices, divisions, and units, focusing on 14 operational areas 
selected by the Board of Directors. Any high-risk area will be addressed in the Annual Audit Work 
Plan. 


TAP International thanks the 32 District employees who participated in this assessment. 


TAP (nterwattonal, tno. 
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Results in Brief -DRAFT 


RESULTS IN BRIEF 


Introduction 


A primary purpose of the Santa Clara Valley Water District (District) Board Audit Committee 
(BAC) is to advance open and accountable government through accurate, independent, and 
objective audits that seek to improve the economy, efficiency, and effectiveness of District 
operations. To support the oversight and monitoring role of the BAC and of the Board, the District 
Board established an independent auditor function in 2017. TAP International, Inc. serves as the 
current independent auditor. To initiate the audit planning function of the independent auditor, 
professional auditing standards urge the use of a risk-based approach in prioritizing audits. The 
results of the risk assessment serve as one mechanism to develop an annual audit plan. Other 
mechanisms include input from the Board of Directors, District management and staff. 


When conducting a risk assessment for auditing purposes, risk is measured by the likelihood of a 
problem occurring and the expected impact of the risk should it materialize. Risk areas represent 
potential opportunities to conduct audits that will provide objective analysis and recommendations 
to improve performance, reduce costs, and strengthen public accountability. Examples of audit 
objectives may include but are not limited to: 


e Determining the cost-effectiveness of a program or activity. 

e Evaluating how an organization can improve its procurement and contracting activities. 

e Assessing the reliability, validity or relevancy of performance measures related to project 
effectiveness, results, economy, or efficiency. 


Using information collected from 13 District office, divisions, and units, hereafter referred to as 
entities, TAP International assessed the need for an audit across 14 operational activities. 


Figure 1. Operational Areas with 
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As shown in Figure 1, there are low needs for audits in 
three of 14 operational activities—Personnel Safety, 
Strategic Goals and Objectives, and Environmental Personnel 
Sustainability. These areas will not likely benefit from ey 

an audit because current activities sufficiently mitigate 
inherent and specific risks. For example, in the area of 
Personnel Safety, the District implements adequate 
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activities that reduce the risk of employee injury. for an Audit 
When injuries do occur, the District responds 
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effectively to prevent their re-occurrence. 
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As shown in Figure 2, there are four areas with high 
need for audits. These areas are: Procurement and 
Contracts, Contract Change Order Management, 
Succession Planning, and Fraud Prevention. For 
example, procurement and contracting processes are 
not implemented based upon risk management 
principles, which subjects all contracts to a lengthy 
review process that may not always be warranted. A 
high-risk score does not mean that an activity is being 
managed ineffectively or indicate whether adequate 
internal controls are in place that function as intended. 
Instead, a high-risk score means that factors are 
present, inherent, or specific, that warrant an audit to 
ensure Board priorities of project and service delivery 
as well as operational effectiveness are met. 


As shown in Figure 3, the District should monitor 
activities in seven areas. These areas include: (1) 
Business Continuity, (2) Capital Planning and 
Management, (3) Financial Management; (4) 
EEO/Diversity, (5) Performance Management, (6) 
Internal Controls, and (7) Transparency. The 
District’s current activities in these areas are sufficient 
to the extent that an audit is not immediately needed, 
but District monitoring is needed to help avoid future 
problems. Monitoring activities can include the review 
of reports submitted to the Board of Directors, spot 
checks of transaction activities, review of project 
outcomes, or short assessments of management 
actions, staffing changes, or short limited audits of 
newly discovered issues and concerns. 


Conclusions 
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Figure 3. Operational Areas that Need 
Monitoring 
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Implementation of a risk assessment serves as one mechanism to support the development of an 
annual audit work program. Areas of high risk and moderate risk could be addressed in the audit 
work program or the District’s Chief Executive Officer can address them internally. The BAC 
provides final review and approval of the audits to be included or not included in the Annual Audit 


Work Plan. 


RECOMMENDATIONS: 


1. The BAC should consider including audits in the Annual Audit Work Plan that address the 


following areas: 
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Contract management and purchasing 
Contract change order management 
Capital project cost estimating 
Workforce planning 


aos Pf 


2. The BAC and District Board of Directors should direct the District’s CEO to actively 
monitor the following areas for continued improvement. These areas include: 


Business Continuity 
e Business impact analysis 


Financial Management 
e Accounts payable administration 
e Financial administration 
e Payroll tax liability reporting 
e Financial performance effectiveness 


Performance Management 
e Budget analytics 


Internal Controls: 
e Control activities 
e Control environment 
e Information and communication 
e Monitoring 


Transparency: 
e Information sharing 


3. The District CEO should act to implement the following recommendations to mitigate 
risks, 

a. To ensure accurate financial reporting, the District, in the next system financial 
system upgrade, should restrict employees from entering unauthorized project codes 
and develop system work flows to ensure supervisors acknowledge and attest to the 
accuracy of the payroll timesheets. 

b. To ensure operating effectiveness, assign responsibility to complete the District’s 
business continuity plan; test the plan to ensure its effectiveness and check the 
working condition of incident response equipment. 

c. To prevent potential fraud, waste, and abuse, establish and implement a fraud 
prevention program that includes (a) delegated responsibility for education and 
training activities, (b) the implementation of a fraud reporting system, and (c) the 
development of policies and procedures for investigating fraud reports. 

d. To better assess operating effectiveness, develop and compute meaningful 
performance measures, such as, the number of contracts over budget, average cost 
overruns, costs to administer accounts payable processing, and cost to administer 
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procurement and contract review from issuance of requests for proposals to contract 
execution. 

e. To enhance succession planning activities, perform a District-wide workforce 
planning study, and develop a District-wide succession plan. 

f. To ensure prompt recovery of operations due to disruption, finalize and test the 
District’s business continuity plan. 


Risk Assessment Results -DRAFT 


PRINCIPAL RESULTS 


Operational Activity Areas that have Low Need for Audits 


Personnel Safety 


Personnel Safety Activity Areas Likelihood* 
Employee Participation 
Safety Governance 


Safety Management 


Impact** 


*The level of need for an audit. 

**Tmpact (if an audit was conducted, the level of impact on Board priorities on service delivery, project delivery, 

or overall effectiveness) 
The risk assessment examined three personnel safety activities—employee participation, safety 
governance, and safety management. District-wide, this operational area showed the least potential 
for concern that an audit is needed. District staff across all the departments that participated in the 
assessment provided positive information about the training and response efforts by Personnel 
Safety. When incidents do occur, the unit responds promptly. Our review of Occupational Safety 
Health Administration (OSHA) records show the last major incident occurred in 2007 that led to 
a fine imposed on the District. 


Strategic Goals and Objectives 


Strategic Goals and Objectives Activity Areas Likelihood Impact 


Goal Setting 


The risk assessment examined strategic goal setting and activities, such as whether the entity’s 
goals reflect the District's highest priorities, how the goals were established, and assignment of 
goal owners. Risk assessment results showed low level of concerns for audits in this area. The 
District sets priorities, focuses energy and resources on goal setting, and ensures that employees 
and other stakeholders are working toward common goals. However, since the District has not yet 
formalized or documented a District-wide strategic plan, there is moderate risk that problems could 
impact operations across multiple departments. 


Environmental Sustainability 


Environmental Sustainability Activity Areas Likelihood Impact 


Green Building 
Water and Wastewater 


The risk assessment examined District activities to facilitate green initiatives and implement 
technology to reduce the District’s carbon footprint with water and wastewater operations. District 
employees raised concerns about the District’s decentralization of environmental stewardship and 
how the District plans to respond to the increasing challenge of complying with environmental 
regulations within the State. While these structural and governance risks were noted, there were 


Risk Assessment Results 


not enough gaps in District activities to raise overall risk levels. While there is not an immediate 
need for audit, District monitoring is needed of its environmental sustainability activities. 


Operational Activity Areas with High Need of Audits 


Purchasing/Contracting 


Purchasing/Contracting Activity Areas Likelihood Impact 
Contract Management 
Purchasing 


The risk assessment examined contract management and purchases activities. Both activity areas 
have high need for audits. Concerns include: 


e The use of an outdated and District-built information system to track and monitor contracts. 

e The long length of time needed by District Counsel to review contracts when suggested 
revisions are grammar related. 

e The absence of effective training in developing requests for proposals and contracts .The 
District, with the hiring of an Interim Chief Operating Officer for Administrative Services, 
implemented extensive training on writing contracts, implementing the request for 
proposal process, and contract negotiations in 2017 and 2018 and plans to offer continued 
training to District staff in the future. The impact of this training on proposal preparation 
and contract processing will need to be monitored by the District. 

e The absence of applying key principles of risk management. Many Requests for Proposals 
and contracts are subject to the same lengthy processes when some types of work do not 
present a high risk to District. 

e The absence of updated purchasing forms, templates, and other tools to govern the 
processes. 


While the District has developed plans to implement improvements, service delivery and operating 
effectiveness, risks will remain without more detailed and comprehensive performance audits. 


Succession planning 


Succession Planning Activity Area Likelihood Impact 
Succession Planning High is 


The risk assessment examined succession planning activities, such as identification of critical skill 
sets, identification and professional development of emerging leaders, and development of 
comprehensive standard operating procedures. While the Human Resources Department has 
provided training on succession planning activities, many divisions and units have not continued 
initial efforts to implement formal succession planning efforts, generally reacting to immediate 
workforce planning needs versus proactive planning. Department officials said the District 
internship program is an excellent resource to hire new and qualified talent, but the length of time 
for positions to become available in some District divisions has hampered succession planning 


Risk Assessment Results 


efforts. In addition, District managers reported that priorities for emerging leader training program 
compete with other higher priorities of the District. 


Contract Change Order Processing 


Change Order Processing Activity Area Likelihood Impact 


Change Order Management 


The risk assessment examined change order management activities because the financial value of 
the District’s change orders can total up to 10 percent of the contract’s original value. For multi- 
million-dollar capital improvement projects, the added costs are significant. The procedures, forms 
and templates used throughout the District to process change orders to contracts varies. Some 
divisions follow robust procedures and others do not. Audits in this area can further examine 
business processes to develop solutions that mitigate District risks. 


Fraud Prevention 


Fraud Prevention Activity Areas Likelihood Impact 


Fraud Detection 
Fraud Governance 
Fraud Prevention 


The risk assessment examined fraud detection, fraud governance, and fraud prevention. A 
government best practice is to have a formal fraud prevention program in place. A fraud program 
clearly assigns responsibility of key staff members for their implementation, and includes 
education, training, and active monitoring of operations. Concerns include: 
e Absence of a formal fraud program. 
e Although many District leaders and managers have general awareness of fraud risks, there 
is no one at the District that is fully responsible for fraud prevention. 
e Absence of mechanisms to report fraud, such as a fraud hotline, to formally report fraud 
although the District’s CEO maintains an open-door policy for staff to report concerns. 
e Absence of independent third-party contract close out audits of large construction projects. 
e Absence of formal fraud detection training. 
e Absence of independent evaluation of construction contractor bid estimates. 


Operational Areas with Moderate Need of Audits or District Monitoring 
Business Continuity 
Likelihood 


Business Continuity Activity Areas Impact 


Business Continuity Plan Management 
Business Impact Analysis 

Disaster Recovery 

Incident Response 


Risk Assessment Results 


The risk assessment examined four business continuity activities — business continuity plan 
development, disaster recovery, incident response, and business impact analysis. Three of the four 
areas examined had moderate risks that need action or monitoring by the District. Our analysis 
found that the District began a comprehensive business continuity planning project that led to 
development of a draft plan. However, the plan has not yet been finished due to staff turnover. In 
the absence of a formal plan and related testing of the plan, the District does not have assurance of 
an effective and prompt response should operational disruptions occur. District staff had general 
awareness of the steps to be implemented in case of operational disruptions, but others raised 
concern over the adequacy of communication protocols and whether communication devices were 
fully functional. 


Capital Planning and Management 


Capital Planning and Management Activity 
Areas Likelihood Impact 


Budgeting 
Planning 
Prioritizing 


The risk assessment examined three capital planning and management activities—budgeting, 
planning, and the process for prioritizing capital project activities. While concerns were found in 
all areas, one of these areas — capital budgeting — has a high need for an audit. Concerns include: 


e The revenue forecasting methodologies used by the District serve to manage cash flow 
needed for capital improvement project, but District staff reported that revenue forecasts 
are not fully consistent with the timing of the project. 

e Review of capital project cost estimates found unrealistic budgets. The procurement staff 
who can help District managers with developing cost estimates do not take part in planning 
meetings. 

e District project managers rely on their personal experience in developing budget estimates 
without consideration of best practices for capital budget development. 


The remaining two areas — capital project planning and prioritization — have moderate risk 
concerning their overall effectiveness. In capital project planning, District staff cited the need to 
conduct District-wide sharing on efforts to plan and perform public engagement activities for 
specific projects. In capital planning prioritization, projects with high priority can encounter 
permitting processes imposed by local, state and federal regulators that can hamper the District's 
ability to deliver capital projects and can delay project construction for years. District monitoring 
is needed in these two areas as the District continually improves on its information sharing efforts 
and works to address regulatory and permitting burdens. 
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Financial Management 


Financial Management Activity Areas 
AP Administration 

Authorization and Review 
Automated Reconciliation Monitoring 
Billing 

Financial Administration 

Financial Performance Effectiveness 
GL Administration 

Payroll Processing 

Payroll Tax Liability Reporting 
Payroll Review and Reconciliation 


Likelihood Impact 


The risk assessment examined 10 areas commonly implemented by government finance 
departments. The Finance Division implements many standard activities, but moderate and high 
risks are present in six of 10 areas examined. Although there was noted improvement within the 
Division since the District’s prior 2014 transparency and accountability audit, our analysis found 
the following: 


e The District has not performed a comprehensive examination of its compliance with 
payroll tax liability reporting, or the accuracy of retirement calculations. Given the District 
has over 800 employees, risks have occurred in other public agencies about the 
overpayment of benefits and incurring significant penalties for untimely tax reporting. 
District monitoring is needed to ensure that controls are in place are working effectively. 

e Payroll timesheet reviews are not performed effectively or consistently throughout the 
District, which impact the financial reporting on projects. 

e Accounts payable processing is manually cumbersome, untimely, and needs substantial 
follow up for some departments by the District’s finance staff. 


Equal Employment Opportunity 


Equal Employment Opportunity 
Activity Areas 


ADA Compliance 
Diversity and Inclusion 
Grievance Management 
Workforce Planning 


Likelihood Impact 


The risk assessment examined four activity areas applicable to equal employment opportunity 
(EEO) — American with Disabilities Act (ADA) compliance, diversity and inclusion, grievance 
management, and workforce planning. Risk levels are mixed across these four areas. The District, 
overall, implements many suggested activities to accomplish ADA compliance and has had low 
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levels of grievances filed against District management leading to the “low” likelihood risk scores!, 
suggesting that audits are not needed in these areas. 


Workforce planning activities, which would identify skillsets needed within each unit and estimate 
future workloads/staffing needs, pose high risks to the District. Workforce planning activities were 
limited across the District, and many divisions raised the concern about the complexity of 
developing a position description and classification that accurately described the work. 


In other EEO areas, the District implements many activities to ensure diversity and inclusion, such 
as establishing different cultural groups. Although each group has its own individual cultural 
identity, the District sponsors regular pot luck luncheons and mini-cultural events that bring the 
groups together. Because the risk assessment focused on concerns that could impact operating 
effectiveness and service/project delivery, we do not believe that audits related to diversity and 
inclusion would significantly impact these goals. 


Performance Management 


Performance Management Activity Areas Likelihood Impact 
Budget Analytics 
Budget Preparation 
Budget Presentation 


Financial Performance Measurement 


The risk assessment examined four areas of performance management — budget analytics, budget 
preparation, budget presentation, and financial performance measurement. The District 
implements many activities across these areas, but key gaps are present in budget analytics 
activities and financial performance measurement. The District does not assess the cost 
effectiveness of agency activities. Performance audits can identify District operations that may not 
spend District resources wisely. 


Transparency 


Transparency Activity Area Likelihood Impact 
Transparency 


The risk assessment examined transparency related to the availability of information, information 
sharing internal and external stakeholders, and conflict of interest activities. In comparison to the 
District’s 2014 transparency and accountability performance audit, the District increased its 
sharing of public information. For instance, the District has enhanced its website, making it easier 
to find information. The District’s Intranet site also has key information available, but District staff 
consistently raised concerns about the effectiveness and timeliness of information sharing between 


1The risk score in one division was high due to potential ADA compliance issues. This area could benefit from 
management attention. A district-wide audit is not needed because potential ADA compliance issues were limited to 
one unit. 


Risk Assessment Results 


District divisions and among employees. District managers report that some departments and 
employees are better than others in giving timely response to internal information requests. Others 
reported inconsistent information sharing on scheduled public engagement activities. Finally, the 
District is working on how it manages conflicts of interests and financial disclosures, which are 
potential auditable areas in the future should newly develop policies and procedures continue to 
present high risk areas for the District. 


Internal Controls 


Internal Controls Activity Areas Likelihood Impact 
Control Activities 

Control Environment 
Information and Communication 


Monitoring 


The risk assessment examined practices for control activities, control environment, information 
and communication and monitoring. The District, through its efforts of following International 
Organization for Standardization (ISO) guidance implements sufficient internal control activities 
but continued monitoring of district activities is needed by District management to ensure that 
current efforts to streamline business processes and upgrade to new information systems continue 
to provide adequate accountability. 


Audit Work Plan 


APPENDIX A: METHODOLOGY 


Goal of the Risk Assessment 


The goal of an audit risk assessment is to identify inherent and specific risks from operational 
activities administered by the District Areas found to have a high potential for problems would be 
recommended for inclusion in an Annual Audit Work Plan. A risk assessment may determine the 
need for audits across programs, services, or activities that the District recognizes for its exemplary 
performance. However, a high performing activity may still not mitigate inherent risks to the 
District. 


Scope of the Risk Assessment 
Operational activities 
The scope of the risk assessment assessed 14 operational activities, as shown in Figure Al. 


Figure A1: Activities included in the Risk Assessment 
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2. Performance Based Budgeting 

a. Financial Management 

4. Internal Controls 
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6. Fraud Prevention 
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2. Contract Change Order Management 
10. Succession Planning 

11. — Business Continuity Planning 

12, Environmental Sustainability 

13. Personnel Safety 

14. Transparency 


Board driven goals 


To evaluate whether each of the 14 operational activities could receive help from an audit, TAP 
International assessed each operational area against three goals, otherwise known as risk factors. 
These risk factors are: 


1. Project Delivery 
2. Service Delivery 
a Effectiveness 


Risk Assessment Results 


District entities taking part in the risk assessment 
Thirteen District entities took part in the risk assessment, as shown in Figure A2. 


Figure A2: District departments included in the Risk Assessment 
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12. Office of District Counsel 
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To select the participating entities for data collection efforts, TAP International analyzed the 
District’s FY 17-18 annual operating and capital budget to identify those entities that comprise 65 
percent of the District’s total $351 million budget. Figures A3 below shows the results of the 
selection analysis. 


Figure A3: Department Selection Data 


Proposed Budget 
Division 2017-2018 
Water Utility Capital Division 108,513,336 
Water Supply Division 87,044,190 
Watershed Design & Construction Division 46,649,727 
Water Utility Operations & Maintenance Division 29,356,864 
Financial Planning and Management Division 28,315,337 
Information Technology Division 10,593,957 
General Services Division 9,467,408 
Watershed Stewardship & Planning Division 7,505,126 
Office of COO Water Utility 7,361,540 
Watershed Operations &Maintenance Division 5,309,289 
Office of COO Watershed 5,117,639 
Office of District Counsel 3,234,587 
Human Resources Division 3,102,761 


Grand Total $351,622,361 


Risk Assessment Results 


District activities were compared against generally accepted government practices and guidance 
for government operations developed by the Government Financial Officer’s Association, U.S. 
Governmental Accountability Office, IBM Center for Performance, Committee of Sponsoring 
Organization (COSO), California Institute of Local Government, and National Institute of 
Technology. TAP International conducted meetings with 32 executives, managers, and supervisors 
across the 14 operational areas and reviewed relevant District documentation such as prior reports, 
budget information, annual reports, policies and procedures, and project information. 


The information collected was assessed and scored to (1) assess the likely occurrence of concerns 
with project and service delivery and operating effectiveness, and (2) assess the potential impact 
to the District if potential risks materialized. Table A4 shows the scoring criteria used for the risk 
assessment. 


Table A4: Risk Assessment Scoring Criteria 


Likelihood for Significant problems in Project 
and Service Delivery 


and Operating Effectiveness— Score 
Rare 1 
Low 2 
Moderate 3 
High 4 
Almost Certain 5 

Impact — Potential reach of Significant Problems Score 
Rare — Little or No Improvement on Any Entity 1 
Low — Single Department 2 
Moderate — Multiple Departments 3 
High — District-Wide 4 
Almost Certain — Public and District 5 


An internal quality review expert later reviewed the analysis for consistency in scoring and 
accuracy. Finally, TAP International identified those areas within each of the 14 operational 
activity areas where audits are most likely to find substantial improvement opportunities that could 
help accomplish the Board’s interest in facilitating overall effectiveness, service delivery, and 
project delivery. 


Risk Assessment Results 
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APPENDIX C: HEAT MAPS - Low Audit Risk Areas 
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APPENDIX D: HEAT MAPS — Moderate Audit Risk Areas 
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APPENDIX E: HEAT MAPS — High Audit Risk Areas 
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